Businesses must prioritize cybersecurity now more than ever. This process requires a broader scope than investing heavily in security technologies, however — the tactic most companies have relied on to date. Relegating cybersecurity measures to IT-only mitigation overlooks the top cybersecurity risk: people.
Organizations have long deployed firewalls — configurations of hardware and software that monitor and control network traffic based on predetermined security rules — around their technical assets. Recently, cutting-edge AI-powered security applications came along as enhancements to the firewall concept. But, as sophisticated threats grow ever wider across distributed endpoints, targeting humans and their vulnerabilities, another kind of firewall is required: a human firewall.
Features of a human firewall
A human firewall is the line of defense people constitute to combat an organization’s security threats. Whereas a technical firewall digitally arbitrates network traffic, a human firewall is a human layer of protection. It is empowered through education and incentives, spanning teams, business functions and technologies across an entire organization.
A human firewall is not:
a single person or “evangelist;”
limited to the security team or any one team;
the sole responsibility of the worker; or
a “set-and-forget” state.
Whereas a technical firewall digitally arbitrates network traffic, a human firewall is a human layer of protection.
A human firewall is not only about targeting the weakest link in the proverbial “security chain.” Rather, it is another chain entirely, one which should be supported and optimized as threats constantly evolve. For example, today’s phishing threats may look different than prevalent phishing threats of five years from now. For that matter, how many employees know what social engineering is?
To build a strong human firewall, companies must provide extensive education, simulation, training and relevance to workers. Security awareness training should not only take place in the context of the company’s core product or service, but in employees’ specific roles and metrics. This goes far beyond the security team to include all workers, from executives and call center agents to product designers and associates in the field.
The role of a human firewall in cybersecurity goes beyond the infosec team, encompassing everyone in the organization.
Why human firewalls are essential in uncertain times
Even before COVID-19 radically affected business operations’ digital reliance, scaled remote work and caused a parallel outbreak in novel cyber threats, organizations faced immense challenges safeguarding their assets, employees, customers and data. These challenges have expanded beyond the four walls of the organization into all manners of networked environments and new ways of working.
Equally important are workers’ morale and engagement, faced with extreme uncertainties. Employers need to galvanize workers, support them professionally and articulate their role within the larger organization. This is to say nothing of the immense talent shortage in cybersecurity, which empowering a human firewall can help mitigate — or even inspire a career pivot.
Humans accelerate a proactive security strategy
As organizations aim to inspire technology adoption by empowering employees to contribute and extract insights without having to go through IT, human firewalls are ultimately part of a longer-term offense.
Just as AI’s predictive capabilities help businesses take a more proactive cybersecurity approach, human intelligence does, too. Although automated techniques are better at managing the volume of potential threat vectors, humans remain the essential arbiters of controls, context, knowledge and explainability. True resilience requires a human firewall in which every employee is trained, equipped and empowered, outnumbering bad actors with a security-minded workforce.
